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ABSTRACT 

A new service detection process in a network retrieves 
a baseline list of port protocols used by a entity being 
tracked- The baseline value is determined over a baseline 
period. A current list of port protocols for the entity 
being tracked is also retrieved and is compared to 
determine whether there is a difference in the port 
protocols, by having a protocol that was in a current list 
but was not in the baseline list. If there is a difference 
the process indicates a new service involving the tracked 
entity. 
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